question about models, ar, and sql strings

[eluser]CroNiX[/eluser]
basically you would have to manually escape any input before saving it like you would any other app. (mysql_escape_string)

$name = $this->db->escape($this->input->post('name'));

$this->db->query("UPDATE `table` set `name` = '$name' WHERE `id` = 4");

If you use AR, CI does this for you on all values being inserted/updated. AR also protects your identifiers automatically by using the backtics (`).

$name = $this->input->post('name');
$this->db->where('id', 4)->update('table', array('name' => $name));